Path: csiph.com!x330-a1.tempe.blueboxinc.net!newsfeed.hal-mli.net!feeder3.hal-mli.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!news.glorb.com!usenet.stanford.edu!not-for-mail
From: Mark Andrews <marka@isc.org>
Newsgroups: comp.protocols.dns.bind
Subject: Re: CNAME logging
Date: Wed, 09 Nov 2011 13:43:31 +1100
Lines: 40
Approved: bind-users@lists.isc.org
Message-ID: <mailman.24.1320806636.68562.bind-users@lists.isc.org>
References: <4EB9E275.6010705@waikato.ac.nz>
NNTP-Posting-Host: lists.isc.org
X-Trace: usenet.stanford.edu 1320806636 27406 149.20.64.75 (9 Nov 2011 02:43:56 GMT)
X-Complaints-To: action@cs.stanford.edu
Cc: bind-users@isc.org
To: mike@waikato.ac.nz
Return-Path: <marka@isc.org>
X-Original-To: bind-users@lists.isc.org
Delivered-To: bind-users@lists.isc.org
In-reply-to: Your message of "Wed, 09 Nov 2011 15:16:21 +1300." <4EB9E275.6010705@waikato.ac.nz>
X-Spam-Status: No, score=-1.5 required=5.0 tests=AWL,BAYES_00, T_RP_MATCHES_RCVD autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mx.ams1.isc.org
X-BeenThere: bind-users@lists.isc.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: BIND Users Mailing List <bind-users.lists.isc.org>
List-Unsubscribe: <https://lists.isc.org/mailman/options/bind-users>, <mailto:bind-users-request@lists.isc.org?subject=unsubscribe>
List-Archive: <https://lists.isc.org/pipermail/bind-users>
List-Post: <mailto:bind-users@lists.isc.org>
List-Help: <mailto:bind-users-request@lists.isc.org?subject=help>
List-Subscribe: <https://lists.isc.org/mailman/listinfo/bind-users>, <mailto:bind-users-request@lists.isc.org?subject=subscribe>
Xref: x330-a1.tempe.blueboxinc.net comp.protocols.dns.bind:64


In message <4EB9E275.6010705@waikato.ac.nz>, Mike Vallabh writes:
> Hi,
> 
> Is it possible to find out whether or not a CNAME is being used?
> I'm using BIND 9.2.2-P1 and am currently logging everything I can think of.
> 
> logging {
>    channel everything {
>            file "/tmp/named_messages";
>            severity debug 1;
>            print-category yes;
>            print-severity yes;
>            print-time yes;
>           } ;
> 
>          category default  {everything; };
>          category queries  {everything; };
>          category lame-servers { null; };
> }
> 
> We literally have hundreds of CNAME records and I am trying to remove 
> all the ones no longer required.
> I realise I could just remove them and see what breaks but that wouldn't 
> be very friendly.
> 
> Cheers,
> Mike Vallabh

Turn on query logging and extract the query names.  Extract the
owner names of the CNAMES records from the the zones.  Find the
common set of names.  Next find the target names of those CNAME and
extract them from the remaining CNAMES.  Repeat until you have no
more new CNAME matches.  Whatever is left was not looked up during
the sample period.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org